FilesExpand file tree

main

/

check-root-directory-entries.mjs

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

70 lines (63 loc) · 2.79 KB

main

/

check-root-directory-entries.mjs

Copy path

Top

File metadata and controls

• Code
• Blame

70 lines (63 loc) · 2.79 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

import { execFileSync } from 'node:child_process'

import { randomUUID } from 'node:crypto'

function readRootEntries(sha) {

// Why: a git pathname is arbitrary bytes, and 'utf8' folds every invalid

// sequence to U+FFFD — that mangles the reported name and makes two different

// entries compare equal, so a genuinely new one can slip past the Set below.

// latin1 maps each byte to one code unit, so the bytes survive the round trip.

const stdout = execFileSync('git', ['ls-tree', '-z', '--name-only', sha], {

encoding: 'latin1',

stdio: ['ignore', 'pipe', 'inherit']

})

return stdout.split('\0').filter(Boolean)

}

// Why: the Cloud workspace import is the one reviewed root addition; it stays

// listed until it lands on main, after which the base tree carries it.

const REVIEWED_ROOT_ENTRIES = new Set(['cloud'])

function checkRootDirectoryEntries(argv) {

if (argv.length !== 2) {

console.error(`Usage: ${process.argv[1]} <base-sha> <head-sha>`)

return 2

}

const [baseSha, headSha] = argv

const baseEntries = new Set(readRootEntries(baseSha))

const blockedEntries = readRootEntries(headSha).filter(

(entry) => !baseEntries.has(entry) && !REVIEWED_ROOT_ENTRIES.has(entry)

)

if (blockedEntries.length === 0) {

console.log('Root directory guard passed: no new root-level files or folders.')

return 0

}

console.log(

'::error title=Root-level additions blocked::New root-level files or folders bloat the GitHub landing page.'

)

console.log('Root directory guard failed.')

console.log(

'New root-level files or folders are not allowed because they bloat the GitHub landing page.'

)

console.log('Move each new entry under an existing top-level directory.')

console.log('Blocked entries:')

// Why: an entry name is attacker-controlled and may start with '::' (the runner

// trims leading spaces before matching) or embed a newline, so printing it bare

// lets a PR forge annotations. Fence the untrusted list with an unguessable

// stop-commands token, and write the raw bytes rather than a re-encoded string.

const resumeToken = randomUUID()

console.log(`::stop-commands::${resumeToken}`)

for (const entry of blockedEntries) {

process.stdout.write(Buffer.from(` ${entry}\n`, 'latin1'))

}

console.log(`::${resumeToken}::`)

return 1

}

try {

// Why: process.exit truncates a piped write part-way through on macOS, so set

// exitCode and let node flush the blocked-entry list before it exits.

process.exitCode = checkRootDirectoryEntries(process.argv.slice(2))

} catch (error) {

// Why: git already reported the failure on the inherited stderr, so surface its

// status rather than a node stack trace. Anything else is a real bug — rethrow.

if (typeof error.status !== 'number') {

throw error

}

process.exitCode = error.status

}